TPSTokens Per Second
product updateCognition

Cognition open-sources Devin plugin with 3 MIT-licensed skills to patch PHP, Node.js, GitLab RCE flaws

TL;DR

Cognition released the Devin Vulnerability Fixes plugin, made up of 3 MIT-licensed agent skills. They inventory, patch and test PHP, Node.js and self-managed GitLab deployments affected by this week's critical RCE flaws, then open 1 PR per repo.

1 min read
0

Cognition released the Devin Vulnerability Fixes plugin, a set of 3 MIT-licensed agent skills that inventory, patch and test PHP, Node.js and self-managed GitLab deployments affected by this week's critical remote code execution (RCE) flaws. The plugin then opens 1 pull request per repository, according to a MarkTechPost report published October 24, 2026.

What was released

  • Plugin: Devin Vulnerability Fixes
  • Components: 3 agent skills
  • License: MIT (open source)
  • Targets: PHP, Node.js and self-managed GitLab deployments
  • Trigger: critical RCE flaws disclosed this week
  • Workflow: inventory, patch, test, then open 1 PR per repo

The report describes the plugin as helping secure systems against recent cybersecurity threats. The URL slug references "php2shell" alongside Node.js and GitLab.

Pricing and availability

Pricing for Devin itself is not covered in the report. The plugin is open source under the MIT license.

What this means

The workflow covers the full remediation sequence: finding affected deployments, applying patches, testing the changes and submitting them for review. Because the output is 1 PR per repo, patches reach maintainers as reviewable pull requests rather than direct changes. The MIT license means teams can use and adapt the three skills in their own environments. The plugin covers three stacks (PHP, Node.js and self-managed GitLab), so teams running any of them can use it against this week's RCE flaws.

Source: marktechpost.com ↗
CognitionDevincybersecurityopen-sourceagent-skillsRCEGitLabNode.js

Related Articles

product update

Deepseek open-sources DeepInfer, the Apache 2.0 inference engine behind its V4.1-Flash model

Deepseek has open-sourced DeepInfer, the internal inference framework that serves its V4.1-Flash model, under the Apache License 2.0. The company says it will also open-source code for future models and has released deepseek-recipe to reproduce its API's token processing in self-hosted setups.

product update

Google's Data Agent Kit reaches GA with 37 open-source skills and an IAM deny policy for read-only agents

Google has made Data Agent Kit generally available. It is free, open source, and installs into Antigravity, Claude Code, Codex, Cursor, and VS Code-compatible editors. It splits guardrails between advisory skills and enforceable IAM deny policies, according to InfoQ.

product update

Alibaba's Qwen Go! Adds My Apps, Building Shareable Apps From a Text Description via Meoo

Alibaba's personal agent Qwen Go! launched My Apps on October 23, letting users describe an app and have it built, configured and deployed without code. The feature runs on Alibaba Cloud's Meoo platform and is in invite-only testing.

product update

iFLYTEK launches Agent OS, APA and XFYUN CLI, putting 700-plus AI capabilities behind one command

At its 2026 Global 1024 Developer Festival in Beijing on October 22, iFLYTEK's open platform introduced Agent OS, APA, the XFYUN CLI and Xingchen TaaS (Token as a Solution). The XFYUN CLI lets one command call more than 700 atomic AI capabilities and more than 200 agent adaptation capabilities. All performance figures are company-reported.

Comments

Loading...